The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
HTMLer - An Automated Broken HTML Generator (Mangleme Python Port)
------------------------------------------------------------------------
SUMMARY
DETAILS
HTMLer is a Python port of the original
<http://freshmeat.net/projects/mangleme/> mangleme (an automated broken
HTML generator to test browsers) with added quirks such as MIME types
(file extensions) and URL types.
HTMLer is a command line driven application, unlike the original mangleme.
It will create a plethora of broken HTML pages in a subdirectory under the
directory in which it is run from. The files are linked in the sense that
opening one in a browser will cause the browser to open the next one
automatically using HTML refresh.
One test scenario found by Berend-Jan Wever is an exploitable buffer
overflow in Internet Explorer when parsing an IFRAME tag in a broken HTML
file named 2446.html. A small excerpt follows:
<IFRAME SRC=AAAAAAAAAAAA.... NAME="BBBBBBBBBBB....">
It allows the crafter of the HTML to control EAX, afterwhich the following
code gets executed:
7178EC02 8B08 MOV ECX, DWORD PTR
[EAX]
7178EC04 68847B7071 PUSH SHDOCVW.71707B84
7178EC09 50 PUSH EAX
7178EC0A FF11 CALL NEAR DWORD PTR
[ECX]
Control over EAX leads to control over ECX which you can use to control
EIP, hence paving the way to remote command execution.
The tool's source can be downloaded from the author's site and is pasted
here for convenience.
Source Code
# jumped in a river what did i see?
# black-eyed angels swimming with me
# SHAMELESS PORT OF LCAMTUF'S MANGELME
# nd@felinemenace.org - (c) 1984
# with a few extra hacks, finds elusive IE bugs ;)
import random
types = []
data = {}
data["A"] = ["NAME", "HREF", "REF", "REV", "TITLE", "TARGET", "SHAPE",
"onLoad", "STYLE"]
data["APPLET"] = ["CODEBASE", "CODE", "NAME", "ALIGN", "ALT", "HEIGHT",
"WIDTH", "HSPACE", "VSPACE", "DOWNLOAD", "HEIGHT", "NAME", "TITLE",
"onLoad", "STYLE"]
data["AREA"] = ["SHAPE", "ALT", "CO-ORDS", "HREF", "onLoad", "STYLE"]
data["B"] = ["onLoad", "STYLE"]
data["BANNER"] = ["onLoad", "STYLE"]
data["BASE"] = ["HREF", "TARGET", "onLoad", "STYLE"]
data["BASEFONT"] = ["SIZE", "onLoad", "STYLE"]
data["BGSOUND"] = ["SRC", "LOOP", "onLoad", "STYLE"]
data["BQ"] = ["CLEAR", "NOWRAP", "onLoad", "STYLE"]
data["BODY"] = ["BACKGROUND", "BGCOLOR", "TEXT", "LINK", "ALINK", "VLINK",
"LEFTMARGIN", "TOPMARGIN", "BGPROPERTIES", "onLoad", "STYLE"]
data["CAPTION"] = ["ALIGN", "VALIGN", "onLoad", "STYLE"]
data["CENTER"] = ["onLoad", "STYLE"]
data["COL"] = ["ALIGN", "SPAN", "onLoad", "STYLE"]
data["COLGROUP"] = ["ALIGN", "VALIGN", "HALIGN", "WIDTH", "SPAN",
"onLoad", "STYLE"]
data["DIV"] = ["ALIGN", "CLASS", "LANG", "onLoad", "STYLE"]
data["EMBED"] = ["SRC", "HEIGHT", "WIDTH", "UNITS", "NAME", "PALETTE",
"onLoad", "STYLE"]
data["FIG"] = ["SRC", "ALIGN", "HEIGHT", "WIDTH", "UNITS", "IMAGEMAP",
"onLoad", "STYLE"]
data["FN"] = ["ID", "onLoad", "STYLE"]
data["FONT"] = ["SIZE", "COLOR", "FACE", "onLoad", "STYLE"]
data["FORM"] = ["ACTION", "METHOD", "ENCTYPE", "TARGET", "SCRIPT",
"onLoad", "STYLE"]
data["FRAME"] = ["SRC", "NAME", "MARGINWIDTH", "MARGINHEIGHT",
"SCROLLING", "FRAMESPACING", "onLoad", "STYLE"]
data["FRAMESET"] = ["ROWS", "COLS", "onLoad", "STYLE"]
data["H1"] = ["SRC", "DINGBAT", "onLoad", "STYLE"]
data["HEAD"] = ["onLoad", "STYLE"]
data["HR"] = ["SRC", "SIZE", "WIDTH", "ALIGN", "COLOR", "onLoad", "STYLE"]
data["HTML"] = ["onLoad", "STYLE"]
data["IFRAME"] = ["ALIGN", "FRAMEBORDER", "HEIGHT", "MARGINHEIGHT",
"MARGINWIDTH", "NAME", "SCROLLING", "SRC", "ADDRESS", "WIDTH", "onLoad",
"STYLE"]
data["IMG"] = ["ALIGN", "ALT", "SRC", "BORDER", "DYNSRC", "HEIGHT",
"HSPACE", "ISMAP", "LOOP", "LOWSRC", "START", "UNITS", "USEMAP", "WIDTH",
"VSPACE", "onLoad", "STYLE"]
data["INPUT"] = ["TYPE", "NAME", "VALUE", "onLoad", "STYLE"]
data["ISINDEX"] = ["HREF", "PROMPT", "onLoad", "STYLE"]
data["LI"] = ["SRC", "DINGBAT", "SKIP", "TYPE", "VALUE", "onLoad",
"STYLE"]
data["LINK"] = ["REL", "REV", "HREF", "TITLE", "onLoad", "STYLE"]
data["MAP"] = ["NAME", "onLoad", "STYLE"]
data["MARQUEE"] = ["ALIGN", "BEHAVIOR", "BGCOLOR", "DIRECTION", "HEIGHT",
"HSPACE", "LOOP", "SCROLLAMOUNT", "SCROLLDELAY", "WIDTH", "VSPACE",
"onLoad", "STYLE"]
data["MENU"] = ["onLoad", "STYLE"]
data["META"] = ["HTTP-EQUIV", "CONTENT", "NAME", "onLoad", "STYLE"]
data["MULTICOL"] = ["COLS", "GUTTER", "WIDTH", "onLoad", "STYLE"]
data["NOFRAMES"] = ["onLoad", "STYLE"]
data["NOTE"] = ["CLASS", "SRC", "onLoad", "STYLE"]
data["OVERLAY"] = ["SRC", "X", "Y", "HEIGHT", "WIDTH", "UNITS",
"IMAGEMAP", "onLoad", "STYLE"]
data["PARAM"] = ["NAME", "VALUE", "onLoad", "STYLE"]
data["RANGE"] = ["FROM", "UNTIL", "onLoad", "STYLE"]
data["SCRIPT"] = ["LANGUAGE", "onLoad", "STYLE"]
data["SELECT"] = ["NAME", "SIZE", "MULTIPLE", "WIDTH", "HEIGHT", "UNITS",
"onLoad", "STYLE"]
data["OPTION"] = ["VALUE", "SHAPE", "onLoad", "STYLE"]
data["SPACER"] = ["TYPE", "SIZE", "WIDTH", "HEIGHT", "ALIGN", "onLoad",
"STYLE"]
data["SPOT"] = ["ID", "onLoad", "STYLE"]
data["TAB"] = ["INDENT", "TO", "ALIGN", "DP", "onLoad", "STYLE"]
data["TABLE"] = ["ALIGN", "WIDTH", "BORDER", "CELLPADDING", "CELLSPACING",
"BGCOLOR", "VALIGN", "COLSPEC", "UNITS", "DP", "onLoad", "STYLE"]
data["TBODY"] = ["CLASS", "ID", "onLoad", "STYLE"]
data["TD"] = ["COLSPAN", "ROWSPAN", "ALIGN", "VALIGN", "BGCOLOR",
"onLoad", "STYLE"]
data["TEXTAREA"] = ["NAME", "COLS", "ROWS", "onLoad", "STYLE"]
data["TEXTFLOW"] = ["CLASS", "ID", "onLoad", "STYLE"]
data["TFOOT"] = ["COLSPAN", "ROWSPAN", "ALIGN", "VALIGN", "BGCOLOR",
"onLoad", "STYLE"]
data["TH"] = ["ALIGN", "CLASS", "ID", "onLoad", "STYLE"]
data["TITLE"] = ["onLoad", "STYLE"]
data["TR"] = ["ALIGN", "VALIGN", "BGCOLOR", "CLASS", "onLoad", "STYLE"]
data["UL"] = ["SRC", "DINGBAT", "WRAP", "TYPE", "PLAIN", "onLoad",
"STYLE"]
for x in data.keys():
types.append(x)
ext =
[".jar",".class",".jpg",".htm",".css",".gif",".png",".eml",".mpg",".wav",".mp3",".swf"]
pre = ["http:","https:","url:","about:","file:","mk:"]
other = ["&","=",":","?","\"","\n","%n%n%n%n%n%n%n%n%n%n%n%n","\\"]
ints =
["0","-1","127","7897","89000","808080","90928345","74326794236234","0xfffffff","ffff"]
class htmler:
maxparams = 20
maxtypes = 20
def __init__(self):
pass
def randnum(self,finish,start=0):
return random.randint(start,finish)
def randstring(self):
char = chr(self.randnum(255))
length = self.randnum(300)
thestring = char * length
what = self.randnum(1)
if what == 0:
which = self.randnum(len(ext) - 1)
thestring += ext[which]
elif what == 1:
which = self.randnum(len(pre) - 1)
thestring = pre[which] + thestring
else:
return
return thestring
def makestring(self):
what = self.randnum(2)
if what == 0:
return self.randstring()
elif what == 1:
return ints[self.randnum(len(ints) - 1)]
elif what == 2:
return other[self.randnum(len(other) - 1)]
def loop(self):
string = ""
i = self.randnum(len(types) - 1)
t = types[i]
arr = data[t]
string += "<%s " % types[i]
z = 0
for z in range(0,self.maxparams):
badparam = arr[self.randnum(len(arr) - 1)]
badstring = self.makestring()
string += "%s=%s " % (badparam,badstring)
string += ">\n"
return string
def main(self):
page = ""
for k in range(0,self.maxtypes):
page += self.loop()
return page
if __name__ == '__main__':
h = htmler()
count = 0
while 1:
shiz = "<HEAD>\n<META HTTP-EQUIV=\"Refresh\"
content=\"0;URL=%d.html\">\n" % (count + 1)
hehe = h.main()
shiz += hehe
print "count -> %d" % count
file = open("html1/%d.html" % count,"w")
file.write(shiz)
file.close()
count += 1
ADDITIONAL INFORMATION
The information has been provided by <mailto:nd@felinemenace.org> ned.
To keep updated with the tool visit the project's homepage at:
<http://felinemenace.org/~nd/htmler.py>
http://felinemenace.org/~nd/htmler.py and
<http://freshmeat.net/projects/mangleme/>
http://freshmeat.net/projects/mangleme/
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
